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SC module notified of new SA 
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SC module allocates new SA to a SecProc module 
and informs all SecProc modules and IPFW modules 
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IP packet filters created by IPFW 
modules based upon SPI of new SA 
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IPFW modules filter IP packets using the new filter and existing filters 
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